One regulation for the whole EU
In the European Union, electronic signatures are governed by Regulation (EU) No 910/2014 on electronic identification and trust services, known as eIDAS. It has applied directly in every member state since 1 July 2016, so there is no need for each country to pass its own version. In 2024 it was amended by Regulation (EU) 2024/1183, sometimes called eIDAS 2, which adds the European Digital Identity Wallet and updates trust services. The three signature levels described here did not change.
This article explains the three levels and when each is used. It is general information, not legal advice. Member state law still decides which documents must be in a particular form, so check local rules for anything unusual.
The basic rule: no denial of legal effect
Article 25(1) of eIDAS says an electronic signature shall not be denied legal effect or admissibility as evidence in legal proceedings solely because it is electronic or because it does not meet the requirements for a qualified signature. In plain words: every level of electronic signature is valid, and a court must look at it on its merits.
The difference between levels is about how much the law presumes. The higher the level, the less you need to prove yourself.
Simple electronic signatures
Article 3(10) defines an electronic signature as data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign. This is often called a simple electronic signature, or SES.
A typed name, a drawn signature, or a click on a Sign button combined with an email check is a simple electronic signature. It is the most common kind and is used for everyday agreements: sales terms, NDAs, supplier forms, most HR documents in many countries, consent forms and internal approvals.
With a simple signature, if someone disputes it, you show the evidence: the identity check, the event log, the timestamp and proof that the document was not changed. A good audit trail is what makes a simple signature strong in practice.
Advanced electronic signatures
Article 26 sets four requirements for an advanced electronic signature, or AdES. It must be uniquely linked to the signatory. It must be capable of identifying the signatory. It must be created using electronic signature creation data that the signatory can, with a high level of confidence, use under their sole control. And it must be linked to the signed data in such a way that any later change to the data is detectable.
In practice, advanced signatures rely on stronger identity checks and on cryptography that binds the signature to the exact content of the document. Advanced signatures are often chosen for higher value commercial contracts, financial documents and agreements where the parties want a stronger presumption of who signed.
eSora Sign supports simple electronic signatures on every plan. Combined with stronger checks, such as SMS codes, access codes or photo ID with a selfie, and with the tamper seal that makes any later change to the PDF detectable, it is built to support the advanced signature requirements. Whether a given signature meets Article 26 depends on how it was set up, so choose the identity check with that in mind.
Qualified electronic signatures
A qualified electronic signature, or QES, is an advanced signature that is created by a qualified signature creation device and based on a qualified certificate for electronic signatures. The certificate must be issued by a qualified trust service provider that appears on an EU member state's trusted list. Getting one usually involves verified identity, often in person or by a regulated video check.
Article 25(2) gives qualified signatures the equivalent legal effect of a handwritten signature. Article 25(3) says a qualified signature based on a qualified certificate issued in one member state is recognised as a qualified signature in all other member states.
Qualified signatures are needed when national law requires a written form that only a QES can replace. Germany is a common example. Where the German Civil Code requires written form, section 126a allows the electronic form only with a qualified electronic signature. Some documents cannot be signed electronically at all: under section 623 of the German Civil Code, ending an employment relationship requires written form and the electronic form is excluded.
eSora Sign does not issue qualified certificates or qualified signatures. If a document must carry a QES, use a qualified trust service provider for that document.
Electronic seals are different
eIDAS also defines electronic seals. A signature is made by a natural person. A seal is applied by a legal person, such as a company, to show that a document came from it and has not changed. Seals have the same three levels: simple, advanced and qualified. When eSora Sign applies its tamper seal to a completed document, it is showing that the file has not changed since signing, not signing on anyone's behalf.
Choosing the right level
Start with the question: does a law require a specific form for this document? If not, a simple electronic signature with a good audit trail is usually enough, and it is the easiest for signers.
If the document is higher risk, or the other party asks for more assurance, use stronger identity checks so that the signature can meet the advanced requirements.
If national law requires written form and only a qualified signature satisfies it, use a qualified provider. If national law excludes electronic form entirely, use paper.
Outside the EU
The United Kingdom kept a version of eIDAS in its own law after leaving the EU, alongside section 7 of the Electronic Communications Act 2000. The Law Commission of England and Wales confirmed in a 2019 report that electronic signatures can generally be used to execute documents. Switzerland has its own law on electronic signatures, known as ZertES. If you send to signers in these countries, the same thinking applies: match the level to the document and keep good evidence.
Data protection
Signing a document creates personal data: names, email addresses, IP addresses and sometimes ID images. The General Data Protection Regulation applies to that data. Ask only for what the document needs, set retention rules, and know where the data is stored. eSora Sign stores data in Canada by default, and Enterprise workspaces can choose EU data residency.
This article is general information, not legal advice.